ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # Reusable workflow — publish.yml 의 release pipeline 이 tag push 시 호출.
  # tag 빌드 전에 main 의 검증이 미실행/실패한 코드가 release 되지 않도록 gate.
  workflow_call:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check-frontend:
    name: Frontend (TypeScript)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile
      - run: pnpm run build

      - name: Security audit (npm)
        run: pnpm audit --audit-level high
        continue-on-error: true

      - name: Upload dist artifact
        uses: actions/upload-artifact@v4
        with:
          name: frontend-dist
          path: dist/
          retention-days: 1

  check-backend:
    name: Backend (Rust)
    needs: check-frontend
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      # 프론트엔드 빌드 결과 다운로드 (중복 빌드 제거)
      - name: Download frontend dist
        uses: actions/download-artifact@v4
        with:
          name: frontend-dist
          path: dist/

      # .gitignore 파일들의 CI placeholder 생성 (Tauri 빌드 스크립트용)
      - name: Create placeholders for Tauri build script
        working-directory: src-tauri
        run: |
          New-Item -ItemType Directory -Force -Path models/kosimcse-roberta-multitask
          New-Item -ItemType File -Force -Path models/kosimcse-roberta-multitask/.gitkeep
          New-Item -ItemType Directory -Force -Path resources
          New-Item -ItemType File -Force -Path resources/node.exe
          New-Item -ItemType Directory -Force -Path resources/kordoc
          New-Item -ItemType File -Force -Path resources/kordoc/.gitkeep
          New-Item -ItemType File -Force -Path icons/tray-icon.png -ErrorAction SilentlyContinue

      - name: Cargo fmt
        working-directory: src-tauri
        run: cargo fmt -- --check

      - name: Cargo check
        working-directory: src-tauri
        run: cargo check --all-targets

      - name: Cargo test
        working-directory: src-tauri
        run: cargo test

      - name: Cargo clippy
        working-directory: src-tauri
        run: cargo clippy -- -D warnings

      - name: Security audit (cargo)
        working-directory: src-tauri
        shell: bash
        continue-on-error: true
        run: |
          cargo install cargo-audit --quiet
          cargo audit

  check-backend-macos:
    name: Backend (Rust on macOS arm64)
    needs: check-frontend
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri
          key: macos-arm64

      - name: Download frontend dist
        uses: actions/download-artifact@v4
        with:
          name: frontend-dist
          path: dist/

      # macOS 빌드 검증용 placeholder 생성
      # (release 빌드는 publish.yml 의 publish-macos job 에서 실제 리소스로 빌드)
      - name: Create placeholders for macOS Tauri build
        working-directory: src-tauri
        run: |
          mkdir -p models/kosimcse-roberta-multitask resources/onnxruntime resources/kordoc resources/paddleocr resources/pdfium
          touch models/kosimcse-roberta-multitask/.gitkeep
          touch resources/node
          chmod +x resources/node
          touch resources/kordoc/.gitkeep
          touch resources/onnxruntime/libonnxruntime.dylib
          # pdfium mac dylib 은 .gitignore(setup-macos-resources.sh 가 실제 생성) — CI 검증용 placeholder
          touch resources/pdfium/libpdfium.dylib
          : > resources/paddleocr/det.onnx
          : > resources/paddleocr/rec.onnx
          : > resources/paddleocr/dict.txt
          touch icons/tray-icon.png

      # [v2.6.4] macos-14 runner 의 `~/.cargo/bin/cargo` 가 `rustup` 으로 symlink 되어
      # 있는데 그 `rustup` binary 의 multi-call detection 이 깨져 cargo argv 호출이
      # `rustup-init: unexpected argument 'check'` 로 fail (v2.6.3 commit 부터 관측).
      # publish.yml 의 mac job 은 pnpm exec tauri build 가 cargo 를 child 로 spawn 하면서
      # toolchain bin 을 직접 쓰는 모양인지 영향 없음.
      # 우회: rustup proxy 가 아니라 toolchain 디렉토리 안의 진짜 cargo binary 를 직접
      # 호출. dtolnay/rust-toolchain@stable + targets:aarch64-apple-darwin → 정확히
      # `~/.rustup/toolchains/stable-aarch64-apple-darwin/bin/cargo` 에 설치됨.
      # [v2.6.24] macos-14 runner 이미지(2026-06 갱신) + rustup 1.28 조합에서,
      # proc-macro 크레이트(proc-macro2/quote)의 build script 를 컴파일하는 `rustc`
      # 호출이 rustup proxy 를 거치면서 rust-src 컴포넌트를 자동 다운로드하려다
      # 실패(`downloading component rust-src` → conflict / rename 오류)해 빌드가 깨진다
      # (이전 runner 이미지에선 통과, 코드 무관). RUSTUP_CARGO 로 cargo 는 toolchain
      # 직접 바이너리로 우회했지만 cargo 가 spawn 하는 rustc 는 여전히 PATH proxy 였던
      # 것이 원인. RUSTC 도 toolchain 직접 바이너리로 지정해 proxy 를 완전히 우회하면
      # auto-install 시도 자체가 사라진다. rust-src 는 이 빌드에 불필요(build-std 미사용).
      - name: Cargo check (mac target)
        working-directory: src-tauri
        env:
          RUSTUP_CARGO: /Users/runner/.rustup/toolchains/stable-aarch64-apple-darwin/bin/cargo
          RUSTC: /Users/runner/.rustup/toolchains/stable-aarch64-apple-darwin/bin/rustc
        run: |
          ls -la "$RUSTUP_CARGO" || (ls -la "$HOME/.rustup/toolchains/" ; exit 1)
          "$RUSTUP_CARGO" --version
          "$RUSTUP_CARGO" check --target aarch64-apple-darwin --all-targets

      - name: Cargo clippy (mac target)
        working-directory: src-tauri
        env:
          RUSTUP_CARGO: /Users/runner/.rustup/toolchains/stable-aarch64-apple-darwin/bin/cargo
          RUSTC: /Users/runner/.rustup/toolchains/stable-aarch64-apple-darwin/bin/rustc
        run: $RUSTUP_CARGO clippy --target aarch64-apple-darwin --all-targets -- -D warnings

      - name: Cargo test (mac target)
        working-directory: src-tauri
        env:
          RUSTUP_CARGO: /Users/runner/.rustup/toolchains/stable-aarch64-apple-darwin/bin/cargo
          RUSTC: /Users/runner/.rustup/toolchains/stable-aarch64-apple-darwin/bin/rustc
        run: $RUSTUP_CARGO test --target aarch64-apple-darwin